shun through sysopt radius ignore-secret Commands

CHAPTER 30 shun through sysopt radius ignore-secret Commands 30-1

shun Chapter 30 shun To block connections from an attacking host, use the shun command in privileged EXEC mode. To disable a shun, use the no form of this command. shun source_ip [dest_ip source_port dest_port [protocol]] [vlan vlan_id] no shun source_ip [vlan vlan_id] Syntax Description dest_port dest_ip protocol source_ip source_port vlan_id (Optional) Specifies the destination port of a current connection that you want to drop when you place the shun on the source IP address. (Optional) Specifies the destination address of a current connection that you want to drop when you place the shun on the source IP address. (Optional) Specifies the IP protocol of a current connection that you want to drop when you place the shun on the source IP address, such as UDP or TCP. By default, the protocol is 0 (any protocol). Specifies the address of the attacking host. If you only specify the source IP address, all future connections from this address are dropped; current connections remain in place. To drop a current connection and also place the shun, specify the additional parameters of the connection. Note that the shun remains in place for all future connections from the source IP address, regardless of destination parameters. (Optional) Specifies the source port of a current connection that you want to drop when you place the shun on the source IP address. (Optional) Specifies the VLAN ID where the source host resides. Defaults The default protocol is 0 (any protocol). Privileged EXEC Release Preexisting Modification This command was preexisting. Usage Guidelines The shun command lets you block connections from an attacking host. All future connections from the source IP address are dropped and logged until the blocking function is removed manually or by the Cisco IPS sensor. The blocking function of the shun command is applied whether or not a connection with the specified host address is currently active. 30-2

Chapter 30 shun If you specify the destination address, source and destination ports, and the protocol, then you drop the matching connection as well as placing a shun on all future connections from the source IP address; all future connections are shunned, not just those that match these specific connection parameters. You can only have one shun command per source IP address. Because the shun command is used to block attacks dynamically, it is not displayed in the adaptive security appliance configuration. Whenever an interface configuration is removed, all shuns that are attached to that interface are also removed. If you add a new interface or replace the same interface (using the same name), then you must add that interface to the IPS sensor if you want the IPS sensor to monitor that interface. Examples The following example shows that the offending host (10.1.1.27) makes a connection with the victim (10.2.2.89) with TCP. The connection in the adaptive security appliance connection table reads as follows: 10.1.1.27, 555-> 10.2.2.89, 666 PROT TCP Apply the shun command using the following options: hostname# shun 10.1.1.27 10.2.2.89 555 666 tcp The command deletes the specific current connection from the adaptive security appliance connection table and also prevents all future packets from 10.1.1.27 from going through the adaptive security appliance. Related Commands Command Description clear shun Disables all the shuns that are currently enabled and clears the shun statistics. show conn Shows all active connections. show shun Displays the shun information. 30-3

shutdown Chapter 30 shutdown To disable an interface, use the shutdown command in interface configuration mode. To enable an interface, use the no form of this command. shutdown no shutdown Syntax Description This command has no arguments or keywords. Defaults All physical interfaces are shut down by default. Allocated interfaces in security contexts are not shut down in the configuration. Interface configuration Release Modification 7.0(1) This command was moved from a keyword of the interface command to an interface configuration mode command. Usage Guidelines The default state of an interface depends on the type and the context mode. In multiple context mode, all allocated interfaces are enabled by default, no matter what the state of the interface is in the system execution space. However, for traffic to pass through the interface, the interface also has to be enabled in the system execution space. If you shut down an interface in the system execution space, then that interface is down in all contexts that share it. In single mode or in the system execution space, interfaces have the following default states: Physical interfaces Disabled. Redundant Interfaces Enabled. However, for traffic to pass through the redundant interface, the member physical interfaces must also be enabled. Subinterfaces Enabled. However, for traffic to pass through the subinterface, the physical interface must also be enabled. Note This command only disables the software interface. The physical link remains up, and the directly connected device is still recognized as being up even when the corresponding interface is configured with the shutdown command. 30-4

Chapter 30 shutdown Examples\ The following example enables a main interface: hostname(config)# interface gigabitethernet0/2 hostname(config-if)# speed 1000 hostname(config-if)# duplex full hostname(config-if)# nameif inside hostname(config-if)# security-level 100 hostname(config-if)# ip address 10.1.1.1 255.255.255.0 hostname(config-if)# no shutdown The following example enables a subinterface: hostname(config)# interface gigabitethernet0/2.1 hostname(config-subif)# vlan 101 hostname(config-subif)# nameif dmz1 hostname(config-subif)# security-level 50 hostname(config-subif)# ip address 10.1.2.1 255.255.255.0 hostname(config-subif)# no shutdown The following example shuts down the subinterface: hostname(config)# interface gigabitethernet0/2.1 hostname(config-subif)# vlan 101 hostname(config-subif)# nameif dmz1 hostname(config-subif)# security-level 50 hostname(config-subif)# ip address 10.1.2.1 255.255.255.0 hostname(config-subif)# shutdown Related Commands Command Description clear xlate Resets all translations for existing connections, causing the connections to be reset. interface Configures an interface and enters interface configuration mode. 30-5

shutdown (ca-server mode) Chapter 30 shutdown (ca-server mode) To disable the local Certificate Authority (CA) server and render the enrollment interface inaccessible to users, use the shutdown command in CA server configuration mode. To enable the CA server, lock down the configuration from changes, and to render the enrollment interface accessible, use the no form of this command. [ no ] shutdown Syntax Description This command has no arguments or keywords. Defaults Initially, by default, the CA server is shut down. CA server configuration Release Modification 8.0(2) This command was introduced. Usage Guidelines This command in CA server mode is similar to the shutdown command in interface mode. At setup time, the local CA server is shutdown by default and must be enabled using the no shutdown command. When you use the no shutdown command for the first time, you enable the CA server and generate the CA server certificate and keypair. Note The CA configuration cannot be changed once you lock it and generate the CA certificate by issuing the no shutdown command. To enable the CA server and lock down the current configuration with the no shutdown command, a 7-character password is required to encode and archive a PKCS12 file containing the CA certificate and keypair that is to be generated. The file is stored to the storage identified by a previously specified database path command. Examples The following example disables the local CA server and renders the enrollment interface inaccessible: hostname(config)# crypto ca server hostname(config-ca-server)# shutdown hostname(config-ca-server)# 30-6

Chapter 30 shutdown (ca-server mode) The following example enables the local CA server and makes the enrollment interface accessible: hostname(config)# crypto ca server hostname(config-ca-server)# no shutdown hostname(config-ca-server)# hostname(config-ca-server)# no shutdown % Some server settings cannot be changed after CA certificate generation. % Please enter a passphrase to protect the private key % or type Return to exit Password: caserver Re-enter password: caserver Keypair generation process begin. Please wait... hostname(config-ca-server)# Related Commands Command Description crypto ca server Provides access to the CA Server Configuration mode CLI command set, which allows you to configure and manage the local CA. show crypto ca server Displays the status of the CA configuration. 30-7

site-id Chapter 30 site-id To assign a site identifier for Call Home, use the site-id command in call-home configuration mode. To remove the site ID, use the no form of this command. site-id alphanumeric no site-id alphanumeric Syntax Description alphanumeric Site identifier, using up to 200 alphanumeric characters. Command Default No site ID is assigned. Call-home configuration Release Modification 8.2(2) We introduced this command. Usage Guidelines The site-id command is optional. You cannot use spaces between words and numbers. Examples The following example configures Site1_ManhattanNY as the customer ID: hostname(config)# call-home hostname(cfg-call-home)# site-id Site1_ManhattenNY Related Commands Command call-home (global configuration) show call-home Description Enters call home configuration mode for configuration of Call Home settings. Displays Call Home configuration information. 30-8

Chapter 30 sla monitor sla monitor To create an SLA operation, use the sla monitor command in global configuration mode. To remove the SLA operation, use the no form of this command. sla monitor sla_id no sla monitor sla_id Syntax Description sla_id Specifies the ID of the SLA being configured. If the SLA does not already exist, it is created. Valid values are from 1 to 2147483647. Defaults No default behavior or values. Global configuration Release Modification 7.2(1) This command was introduced. Usage Guidelines The sla monitor command creates SLA operations and enters SLA Monitor configuration mode. Once you enter this command, the command prompt changes to hostname(config-sla-monitor)# to indicate that you are in SLA Monitor configuration mode. If the SLA operation already exists, and a type has already been defined for it, then the prompt appears as hostname(config-sla-monitor-echo)#. You can create a maximum of 2000 SLA operations. Only 32 SLA operations may be debugged at any time. The no sla monitor command removes the specified SLA operation and the commands used to configure that operation. After you configure an SLA operation, you must schedule the operation with the sla monitor schedule command. You cannot modify the configuration of the SLA operation after scheduling it. To modify the configuration of a scheduled SLA operation, you must use the no sla monitor command to remove the selected SLA operation completely. Removing an SLA operation also removes the associated sla monitor schedule command. Then you can reenter the SLA operation configuration. To display the current configuration settings of the operation, use the show sla monitor configuration command. To display operational statistics of the SLA operation, use the show sla monitor operation-state command. To see the SLA commands in the configuration, use the show running-config sla monitor command. 30-9

sla monitor Chapter 30 Examples The following example configures an SLA operation with an ID of 123 and creates a tracking entry with the ID of 1 to track the reachability of the SLA: hostname(config)# sla monitor 123 hostname(config-sla-monitor)# type echo protocol ipicmpecho 10.1.1.1 interface outside hostname(config-sla-monitor-echo)# timeout 1000 hostname(config-sla-monitor-echo)# frequency 3 hostname(config)# sla monitor schedule 123 life forever start-time now hostname(config)# track 1 rtr 123 reachability Related Commands Command Description frequency Specifies the rate at which the SLA operation repeats. show sla monitor Displays the SLA configuration settings. configuration sla monitor schedule Schedules the SLA operation. timeout Sets the amount of time the SLA operation waits for a response. track rtr Creates a tracking entry to poll the SLA. 30-10

Chapter 30 sla monitor schedule sla monitor schedule To schedule an SLA operation, use the sla monitor schedule command in global configuration mode. To remove SLA operation schedule, and place the operation in the pending state, use the no form of this command. sla monitor schedule sla-id [life {forever seconds}] [start-time {hh:mm[:ss] [month day day month] pending now after hh:mm:ss}] [ageout seconds] [recurring] no sla monitor schedule sla-id Syntax Description after hh:mm:ss Indicates that the operation should start the specified number of hours, minutes, and seconds after the command was entered. ageout seconds (Optional) Specifies the number of seconds to keep the operation in memory when it is not actively collecting information. After an SLA operation ages out, it is removed from the running configuration. day Number of the day to start the operation on. Valid values are from 1 to 31. If a day is not specified, then the current day is used. If you specify a day you must also specify a month. hh:mm[:ss] life forever life seconds month now pending recurring sla-id start-time Specifies an absolute start time in 24-hour notation. Seconds are optional. The next time the specified time occurs is implied unless you specify a month and a day. (Optional) Schedules the operation to run indefinitely. (Optional) Sets the number of seconds the operation actively collects information. (Optional) Name of the month to start the operation in. If a month is not specified, then the current month is used. I f you specify a month you must also specify a day. You can enter the full English name of the month or just the first three letters. Indicates that the operation should start as soon as the command is entered. Indicates that no information is collected. This is the default state. (Optional) Indicates that the operation will start automatically at the specified time and for the specified duration every day. The ID of the SLA operation being scheduled. Sets the time when the SLA operation starts. Defaults The defaults are as follows: SLA operations are in the pending state until the scheduled time is met. This means that the operation is enabled but not actively collecting data. The default ageout time is 0 seconds (never ages out). The default life is 3600 seconds (one hour). 30-11

sla monitor schedule Chapter 30 Global configuration Release Modification 7.2(1) This command was introduced. Usage Guidelines When an SLA operation is in an active state, it immediately begins collecting information. The following time line shows the age-out process of the operation: W----------------------X----------------------Y----------------------Z W is the time the SLA operation was configured with the sla monitor command. X is the start time of the SLA operation. This is when the operation became active. Y is the end of life as configured with the sla monitor schedule command (the life seconds have counted down to zero). Z is the age out of the operation. The age out process, if used, starts counting down at W, is suspended between X and Y, and is reset to its configured size are starts counting down again at Y. When an SLA operation ages out, the SLA operation configuration is removed from the running configuration. It is possible for the operation to age out before it executes (that is, Z can occur before X). To ensure that this does not happen, the difference between the operation configuration time and start time (X and W) must be less than the age-out seconds. The recurring keyword is only supported for scheduling single SLA operations. You cannot schedule multiple SLA operations using a single sla monitor schedule command. The life value for a recurring SLA operation should be less than one day. The ageout value for a recurring operation must be never (which is specified with the value 0), or the sum of the life and ageout values must be more than one day. If the recurring option is not specified, the operations are started in the existing normal scheduling mode. You cannot modify the configuration of the SLA operation after scheduling it. To modify the configuration of a scheduled SLA operation, you must use the no sla monitor command to remove the selected SLA operation completely. Removing an SLA operation also removes the associated sla monitor schedule command. Then you can reenter the SLA operation configuration. Examples The following example shows SLA operation 25 scheduled to begin actively collecting data at 3:00 p.m. on April 5. This operation will age out after 12 hours of inactivity. When this SLA operation ages out, all configuration information for the SLA operation is removed from the running configuration. hostname(config)# sla monitor schedule 25 life 43200 start-time 15:00 apr 5 ageout 43200 The following example shows SLA operation 1 schedule to begin collecting data after a 5-minute delay. The default life of one hour applies. hostname(config)# sla monitor schedule 1 start after 00:05:00 30-12

Chapter 30 sla monitor schedule The following example shows SLA operation 3 scheduled to begin collecting data immediately and is scheduled to run indefinitely: hostname(config)# sla monitor schedule 3 life forever start-time now The following example shows SLA operation 15 scheduled to begin automatically collecting data every day at 1:30 a.m.: hostname(config)# sla monitor schedule 15 start-time 01:30:00 recurring Related Commands Command Description show sla monitor Displays the SLA configuration settings. configuration sla monitor Defines an SLA monitoring operation. 30-13

smart-tunnel auto-signon enable Chapter 30 smart-tunnel auto-signon enable To enable smart tunnel auto sign-on in clientless (browser-based) SSL VPN sessions, use the smart-tunnel auto-signon enable command in group-policy webvpn configuration mode or username webvpn configuration mode. [no] smart-tunnel auto-signon enable list [domain domain] To remove the smart-tunnel auto-signon enable command from the group policy or username and inherit it from the default group-policy, use the no form of the command. Syntax Description list domain domain list is the name of a smart tunnel auto sign-on list already present in the adaptive security appliance webvpn configuration. To view the smart tunnel auto sign-on list entries in the SSL VPN configuration, enter the show running-config webvpn smart-tunnel command in privileged EXEC mode. (Optional). Name of the domain to be added to the username during authentication. If you enter a domain, enter the use-domain keyword in the list entries. Defaults No default behavior or values. group-policy webvpn configuration mode username webvpn configuration mode Release Modification 8.0(4) This command was introduced. Usage Guidelines The smart-tunnel auto sign-on feature supports only applications communicating HTTP and HTTPS using the Microsoft WININET library. For example, Microsoft Internet Explorer uses the WININET dynamic linked library to communicate with web servers. You must use the smart-tunnel auto-signon list command to create a list of servers first. You can assign only one list to a group policy or username. 30-14

Chapter 30 smart-tunnel auto-signon enable Examples The following commands enable the smart tunnel auto sign-on list named HR: hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# smart-tunnel auto-signon enable HR hostname(config-group-webvpn) The following command enables the smart tunnel auto sign-on list named HR and adds the domain named CISCO to the username during authentication: hostname(config-group-webvpn)# smart-tunnel auto-signon enable HR domain CISCO The following command removes the smart tunnel auto sign-on list named HR from the group policy and inherits the smart tunnel auto sign-on list command from the default group policy: hostname(config-group-webvpn)# no smart-tunnel auto-signon enable HR Related Commands Command Description smart-tunnel auto-signon list show running-config webvpn smart-tunnel smart-tunnel auto-start smart-tunnel disable smart-tunnel list Create a list of servers for which to automate the submission of credentials in smart tunnel connections. Displays the smart tunnel configuration on the adaptive security appliance. Starts smart tunnel access automatically upon user login. Prevents smart tunnel access. Adds an entry to a list of applications that can use a Clientless SSL VPN session to connect to private sites. 30-15

smart-tunnel auto-signon list Chapter 30 smart-tunnel auto-signon list To create a list of servers for which to automate the submission of credentials in smart tunnel connections, use the smart-tunnel auto-signon list command in webvpn configuration mode. [no] smart-tunnel auto-signon list [use-domain] {ip ip-address [netmask] host hostname-mask} Use this command for each server you want to add to a list. To remove an entry from a list, use the no form of the command, specifying both the list and the IP address or hostname, as it appears in the adaptive security appliance configuration. To display the smart tunnel auto sign-on list entries, enter the show running-config webvpn smart-tunnel command in privileged EXEC mode. To remove an entire list of servers from the adaptive security appliance configuration, use the no form of the command, specifying only the list. no smart-tunnel auto-signon list Syntax Description host hostname-mask ip ip-address [netmask] list Server to be identified by its host name or wildcard mask. Host name or wildcard mask to auto-authenticate to. Server to be identified by its IP address and netmask. Sub-network of hosts to auto-authenticate to. Name of a list of remote servers. Use quotation marks around the name if it includes a space. The string can be up to 64 characters. The adaptive security appliance creates the list if it is not present in the configuration. Otherwise, it adds the entry to the list. use-domain (Optional) Add the Windows domain to the username if authentication requires it. If you enter this keyword, be sure to specify the domain name when assigning the smart tunnel list to one or more group policies, or usernames. Defaults No default behavior or values. webvpn configuration mode Release Modification 8.0(4) This command was introduced. 30-16

Chapter 30 smart-tunnel auto-signon list Usage Guidelines The smart-tunnel auto sign-on feature supports only applications communicating HTTP and HTTPS using the Microsoft WININET library. For example, Microsoft Internet Explorer uses the WININET dynamic linked library to communicate with web servers. Following the population of a smart tunnel auto sign-on list, use the smart-tunnel auto-signon enable list command in group policy webvpn or username webvpn mode to assign the list. Examples The following command adds all hosts in the subnet and adds the Windows domain to the username if authentication requires it: asa2(config-webvpn)# smart-tunnel auto-signon HR use-domain ip 192.32.22.56 255.255.255.0 The following command removes that entry from the list: asa2(config-webvpn)# no smart-tunnel auto-signon HR use-domain ip 192.32.22.56 255.255.255.0 The command shown above also removes the list named HR if the entry removed is the only entry in the list. Otherwise, the following command removes the entire list from the adaptive security appliance configuration: asa2(config-webvpn)# no smart-tunnel auto-signon HR The following command adds all hosts in the domain to the smart tunnel auto sign-on list named intranet: asa2(config-webvpn)# smart-tunnel auto-signon intranet host *.exampledomain.com The following command removes that entry from the list: asa2(config-webvpn)# no smart-tunnel auto-signon intranet host *.exampledomain.com Related Commands Command Description smart-tunnel auto-signon enable smart-tunnel auto-signon enable list show running-config webvpn smart-tunnel smart-tunnel auto-start smart-tunnel enable Enables smart tunnel auto sign-on for the group policy or username specified in the command mode. Assigns a smart tunnel auto sign-on list to a group policy or username Displays the smart tunnel configuration. Starts smart tunnel access automatically upon user login. Enables smart tunnel access upon user login, but requires the user to start smart tunnel access manually, using the Application Access > Start Smart Tunnels button on the Clientless SSL VPN portal page. 30-17

smart-tunnel auto-start Chapter 30 smart-tunnel auto-start To start smart tunnel access automatically upon user login in a clientless (browser-based) SSL VPN session, use the smart-tunnel auto-start command in group-policy webvpn configuration mode or username webvpn configuration mode. smart-tunnel auto-start list To remove the smart-tunnel command from the group policy or username and inherit the [no] smart-tunnel command from the default group-policy, use the no form of the command. no smart-tunnel Syntax Description list list is the name of a smart tunnel list already present in the adaptive security appliance webvpn configuration. To view any smart tunnel list entries already present in the SSL VPN configuration, enter the show running-config webvpn command in privileged EXEC mode. Defaults No default behavior or values. group-policy webvpn configuration mode username webvpn configuration mode Release Modification 8.0(2) This command was introduced. Usage Guidelines This command requires that you use the smart-tunnel list command to create the list of applications first. Examples The following commands start smart tunnel access for a list of applications named apps1: hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# smart-tunnel auto-start apps1 hostname(config-group-webvpn) 30-18

Chapter 30 smart-tunnel auto-start The following commands remove the list named apps1 from the group policy and inherit the smart tunnel commands from the default group policy: hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# no smart-tunnel hostname(config-group-webvpn) Related Commands Command Description show running-config webvpn Displays the Clientless SSL VPN configuration, including all smart tunnel list entries. smart-tunnel disable Prevents smart tunnel access. smart-tunnel enable Enables smart tunnel access upon user login, but requires the user to start smart tunnel access manually, using the Application Access > Start Smart Tunnels button on the Clientless SSL VPN portal page. smart-tunnel list Adds an entry to a list of applications that can use a Clientless SSL VPN session to connect to private sites. 30-19

smart-tunnel disable Chapter 30 smart-tunnel disable To prevent smart tunnel access through clientless (browser-based) SSL VPN sessions, use the smart-tunnel disable command in group-policy webvpn configuration mode or username webvpn configuration mode. smart-tunnel disable To remove a smart-tunnel command from the group policy or username and inherit the [no] smart-tunnel command from the default group-policy, use the no form of the command. no smart-tunnel Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. group-policy webvpn configuration mode username webvpn configuration mode Release Modification 8.0(2) This command was introduced. Usage Guidelines By default, smart tunnels are not enabled, so the smart-tunnel disable command is necessary only if the (default) group policy or username configuration contains a smart-tunnel auto-start or smart-tunnel enable command that you do not want applied for the group policy or username in question. Examples The following commands prevent smart tunnel access: hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# smart-tunnel disable hostname(config-group-webvpn) 30-20

Chapter 30 smart-tunnel disable Related Commands Command Description smart-tunnel auto-start Starts smart tunnel access automatically upon user login. smart-tunnel enable smart-tunnel list Enables smart tunnel access upon user login, but requires the user to start smart tunnel access manually, using the Application Access > Start Smart Tunnels button on the Clientless SSL VPN portal page. Adds an entry to a list of applications that can use a Clientless SSL VPN session to connect to private sites. 30-21

smart-tunnel enable Chapter 30 smart-tunnel enable To enable smart tunnel access through clientless (browser-based) SSL VPN sessions, use the smart-tunnel enable command in group-policy webvpn configuration mode or username webvpn configuration mode. smart-tunnel enable list To remove the smart-tunnel command from the group policy or username and inherit the [no] smart-tunnel command from the default group-policy, use the no form of the command. no smart-tunnel Syntax Description list list is the name of a smart tunnel list already present in the adaptive security appliance webvpn configuration. To view the smart tunnel list entries in the SSL VPN configuration, enter the show running-config webvpn command in privileged EXEC mode. Defaults No default behavior or values. group-policy webvpn configuration mode username webvpn configuration mode Release Modification 8.0(2) This command was introduced. Usage Guidelines The smart-tunnel enable command assigns a list of applications eligible for smart tunnel access to a group policy or username. It requires the user to start smart tunnel access manually, using the Application Access > Start Smart Tunnels button on the clientless-ssl-vpn portal page. Alternatively, you can use the smart-tunnel auto-start command to start smart tunnel access automatically upon user login. Both commands require that you use the smart-tunnel list command to create the list of applications first. 30-22

Chapter 30 smart-tunnel enable Examples The following commands enable the smart tunnel list named apps1: hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# smart-tunnel enable apps1 hostname(config-group-webvpn) The following commands remove the list named apps1 from the group policy and inherit the smart tunnel list from the default group policy: hostname(config-group-policy)# webvpn hostname(config-group-webvpn)# no smart-tunnel hostname(config-group-webvpn) Related Commands Command Description show running-config webvpn Displays the Clientless SSL VPN configuration, including all smart tunnel list entries. smart-tunnel auto-start Starts smart tunnel access automatically upon user login. smart-tunnel disable Prevents smart tunnel access. smart-tunnel list Adds an entry to a list of applications that can use a Clientless SSL VPN session to connect to private sites. 30-23

smart-tunnel list Chapter 30 smart-tunnel list To populate a list of applications that can use a clientless (browser-based) SSL VPN session to connect to private sites, use the smart-tunnel list command in webvpn configuration mode. [no] smart-tunnel list list application path [platform OS] [hash] To remove an application from a list, use the no form of the command, specifying the entry. To remove an entire list of applications from the adaptive security appliance configuration, use the no form of the command, specifying only the list. no smart-tunnel list list Syntax Description list Name of a list of applications or programs. Use quotation marks around the name if it includes a space. The CLI creates the list if it is not present in the configuration. Otherwise, it adds the entry to the list. application Name of the application to be granted smart tunnel access. The string can be up to 64 characters. path platform OS hash For Mac OS, the full path to the application. For Windows, the filename of the application; or a full or partial path to the application, including its filename. The string can be up to 128 characters. (Optional if the OS is Microsoft Windows) Enter windows or mac to specify the host of the application. (Optional and applicable only for Windows) To obtain this value, enter the checksum of the application (that is, the checksum of the executable file) into a utility that calculates a hash using the SHA-1 algorithm. One example of such a utility is the Microsoft File Checksum Integrity Verifier (FCIV), which is available at http://support.microsoft.com/kb/841290/. After installing FCIV, place a temporary copy of the application to be hashed on a path that contains no spaces (for example, c:/fciv.exe), then enter fciv.exe -sha1 application at the command line (for example, fciv.exe -sha1 c:\msimn.exe) to display the SHA-1 hash. The SHA-1 hash is always 40 hexadecimal characters. Defaults Windows is the default platform. webvpn configuration mode 30-24

Chapter 30 smart-tunnel list Release Modification 8.0(2) This command was introduced. 8.0(4) Added platform OS. Usage Guidelines You can configure more than one smart tunnel list on a adaptive security appliance, but you cannot assign more than one smart tunnel list to a given group policy or username. To populate a smart tunnel list, enter the smart-tunnel list command once for each application, entering the same list string, but specifying an application and path that is unique for the OS. Enter the command once for each OS you want the list to support. The session ignores a list entry if the OS does not match the one indicated in the entry. It also ignores an entry if the path to the application is not present. To view the smart tunnel list entries in the SSL VPN configuration, enter the show running-config webvpn smart-tunnel command in privileged EXEC mode. The path must match the one on the computer, but it does not have to be complete. For example, the path can consist of nothing more than the executable file and its extension. Smart tunnels have the following requirements: The remote host originating the smart tunnel connection must be running a 32-bit version of Microsoft Windows Vista, Windows XP, or Windows 2000; or Mac OS 10.4 or 10.5. Users of Microsoft Windows Vista who use smart tunnels or port forwarding must add the URL of the ASA to the Trusted Site zone. To access the Trusted Site zone, they must start Internet Explorer and choose the Tools > Internet Options > Security tab. Vista users can also disable Protected Mode to facilitate smart tunnel access; however, we recommend against this method because it increases the computer s vulnerability to attack. The browser must be enabled with Java, Microsoft ActiveX, or both. Smart tunnel support for Mac OS requires Safari 3.1.1 or later. On Microsoft Windows, only Winsock 2, TCP-based applications are eligible for smart tunnel access. On Mac OS, applications using TCP that are dynamically linked to the SSL library can work over a smart tunnel. The following types of applications do not work over a smart tunnel: Applications using dlopen or dlsym to locate libsocket calls Statically linked applications to locate libsocket calls Mac OS applications that use two-level name spaces. Mac OS, console-based applications, such as Telnet, SSH, and curl. Mac OS, PowerPC-type applications. To determine the type of a Mac OS application, right-click its icon and select Get Info. On Mac OS, only applications started from the portal page can establish smart tunnel sessions. This requirement includes smart tunnel support for Firefox.Using Firefox to start another instance of Firefox during the first use of a smart tunnel requires the user profile named csco_st. If this user profile is not present, the session prompts the user to create one. The following limitations apply to smart tunnels: If the remote computer requires a proxy server to reach the adaptive security appliance, the URL of the terminating end of the connection must be in the list of URLs excluded from proxy services. In this configuration, smart tunnels support only basic authentication. 30-25

smart-tunnel list Chapter 30 The security appliance does not support the Microsoft Outlook Exchange (MAPI) proxy. Neither the smart tunnel feature nor port forwarding supports MAPI. For Microsoft Outlook Exchange communication using the MAPI protocol, remote users must use AnyConnect. The smart tunnel auto sign-on feature supports only applications communicating HTTP and HTTPS using the Microsoft WININET library on a Microsoft Windows OS. For example, Microsoft Internet Explorer uses the WININET dynamic linked library to communicate with web servers. A group policy or local user policy supports no more than one list of applications eligible for smart tunnel access and one list of smart tunnel auto sign-on servers. A stateful failover does not retain smart tunnel connections. Users must reconnect following a failover. Note A sudden problem with smart tunnel access may be an indication that a path value is not up-to-date with an application upgrade. For example, the default path to an application typically changes following the acquisition of the company that produces the application and the next upgrade. Entering a hash provides a reasonable assurance that clientless SSL VPN does not qualify an illegitimate file that matches the string you specified in the path. Because the checksum varies with each version or patch of an application, the hash you enter can only match one version or patch on the remote host. To specify a hash for more than one version of an application, enter the smart-tunnel list command once for each version, entering the same list string, but specifying the unique application string and unique hash value in each command. Note You must maintain the smart tunnel list in the future if you enter hash values and you want to support future versions or patches of an application with smart tunnel access. A sudden problem with smart tunnel access may be an indication that the application list containing hash values is not up-to-date with an application upgrade. You can avoid this problem by not entering a hash. Following the configuration of a smart tunnel list, use the smart-tunnel auto-start or smart-tunnel enable command to assign the list to group policies or usernames. Examples The following command adds a Microsoft Windows application named connect.exe to a smart tunnel list named apps1: hostname(config-webvpn)# smart-tunnel list apps1 LotusSametime connect.exe The following command adds the Windows application msimn.exe and requires that the hash of the application on the remote host match the last string entered to qualify for smart tunnel access: hostname(config-webvpn)# smart-tunnel list apps1 OutlookExpress msimn.exe 4739647b255d3ea865554e27c3f96b9476e75061 The following command provides smart tunnel support for the Mac OS browser Safari: hostname(config-webvpn)# smart-tunnel list apps1 Safari /Applications/Safari platform mac 30-26

Chapter 30 smart-tunnel list Related Commands Command Description show running-config webvpn smart-tunnel smart-tunnel auto-start smart-tunnel disable smart-tunnel enable Displays the smart tunnel configuration on the adaptive security appliance. Starts smart tunnel access automatically upon user login. Prevents smart tunnel access. Enables smart tunnel access upon user login, but requires the user to start smart tunnel access manually, using the Application Access > Start Smart Tunnels button on the Clientless SSL VPN portal page. 30-27

smartcard-removal-disconnect Chapter 30 smartcard-removal-disconnect To disconnect or retain an IPsec client session if the smart card is removed from the user s computer, use the smartcard-removal-disconnect command in group-policy configuration mode. smartcard-removal-disconnect {enable disable} To remove the smartcard-removal-disconnect command from the group policy and inherit the setting from the default group-policy, use the no form of the command. no smartcard-removal-disconnect Syntax Description enable disable Terminates the IPsec client session if the smart card is removed from the user s computer. Lets the IPsec client session continue even if the smart card is removed from the user s computer. Defaults enable group-policy configuration mode Release Modification 7.0(2) This command was introduced. Usage Guidelines By default, the IPsec client session disconnects if the smart card used for authentication is removed. Enter the smartcard-removal-disconnect disable command if you do not want to require users to keep their smart cards in the computer for the duration of the connection. Examples The following command lets the client session continue even if the smart card is removed from the user s computer: hostname(config-group-policy)# smartcard-removal-disconnect disable hostname(config-group-policy) 30-28

Chapter 30 smartcard-removal-disconnect The following command terminates the client session if the smart card is removed from the user s computer: hostname(config-group-policy)# smartcard-removal-disconnect enable 30-29

smtp from-address Chapter 30 smtp from-address To specify the e-mail address to use in the E-mail From: field for all e-mails generated by the local CA server (such as distribution of one-time passwords) use the smtp from-address command in CA server configuration mode. To reset the e-mail address to the default, use the no form of this command. smtp from-address e-mail_address no smtp from-address Syntax Description e-mail_address Specifies the e-mail address appearing in the From: field of all e-mails generated by the CA server. Defaults No default behavior or values. CA server configuration Release Modification 8.0(2) This command was introduced. Examples The following example specifies that the From: field of all e-mails from the local CA server include ca-admin@asa1-ca.example.com: hostname(config)# crypto ca server hostname(config-ca-server)# smtp from-address ca-admin@asa1-ca.example.com hostname(config-ca-server)# The following example resets the From: field of all e-mails from the local CA server to the default address admin@asa1-ca.example.com: hostname(config)# crypto ca server hostname(config-ca-server)# smtp from-address admin@asa1-ca.example.com hostname(config-ca-server)# Related Commands 30-30

Chapter 30 smtp from-address Command crypto ca server smtp subject Description Provides access to CA Server Configuration mode CLI command set, which allows you to configure and manage a local CA. Customizes the text to appear in the subject field of all e-mails generated by the local CA server. 30-31

smtp subject Chapter 30 smtp subject To customize the text that appears in the subject field of all e-mails generated by the local Certificate Authority (CA) server (such as distribution of one-time passwords), use the smtp subject command in CA server configuration mode. To reset the text to the default, use the no form of this command. smtp subject subject-line no smtp subject Syntax Description subject-line Specifies the text appearing in the Subj: field of all e-mails sent from the CA server. The maximum number of characters is 127. Defaults By default, the text in the Subj: field is Certificate Enrollment Invitation. CA server configuration Release Modification 8.0(2) This command was introduced. Examples The following example specifies that the text Action: Enroll for a certificate appear in the Subj: field of all e-mails from the CA server: hostname(config)# crypto ca server hostname(config-ca-server)# smtp subject Action: Enroll for a certificate hostname(config-ca-server)# The following example resets the Subj: field text for all e-mails from the CA server to the default text Certificate Enrollment Invitation : hostname(config)# crypto ca server hostname(config-ca-server)# no smtp subject hostname(config-ca-server)# 30-32

Chapter 30 smtp subject Related Commands Command Description crypto ca server Provides access to CA Server Configuration mode CLI command set, which allows you to configure and manage a local CA. smtp from-address Specifies the e-mail address to use in the E-mail From: field for all e-mails generated by the local CA server. 30-33

smtps Chapter 30 smtps To enter SMTPS configuration mode, use the smtps command in global configuration mode. To remove any commands entered in SMTPS command mode, use the no version of this command. SMTPS is a TCP/IP protocol that lets you to send e-mail over an SSL connection. smtps no smtps Syntax Description This command has no arguments or keywords. Defaults No default behavior or values. Global configuration Release Modification 7.0 This command was introduced. Examples The following example shows how to enter SMTPS configuration mode: hostname(config)# smtps hostname(config-smtps)# Related Commands Command clear configure smtps show running-config smtps Description Removes the SMTPS configuration. Displays the running configuration for SMTPS. 30-34

Chapter 30 smtp-server smtp-server To configure an SMTP server, use the smtp-server command in global configuration mode. To remove the attribute from the configuration, use the no form of this command. smtp-server {primary_server} [backup_server] no smtp-server Syntax Description backup_server primary_server Identifies a backup SMTP server to relay event messages if the primary SMTP server is unavailable. Use either an IP address or DNS name. Identifies the primary SMTP server. Use either an IP address or DNS name Defaults No default behavior or values. Global configuration Release Modification 7.0(1) This command was introduced. Usage Guidelines The adaptive security appliance includes an internal SMTP client that the Events system can use to notify external entities that a certain event has occurred. You can configure SMTP servers to receive these event notices, and then forward them to specified e-mail addresses. The SMTP facility is active only when you enable E-mail events to the adaptive security appliance. Examples The following example shows how to set an SMTP server with an IP address of 10.1.1.24, and a backup SMTP server with an IP address of 10.1.1.34: hostname(config)# smtp-server 10.1.1.24 10.1.1.34 30-35

snmp-map Chapter 30 snmp-map To identify a specific map for defining the parameters for SNMP inspection, use the snmp-map command in global configuration mode. To remove the map, use the no form of this command. snmp-map map_name no snmp-map map_name Syntax Description map_name The name of the SNMP map. Defaults No default behavior or values. Global configuration Release Modification 7.0(1) This command was introduced. Usage Guidelines Use the snmp-map command to identify a specific map to use for defining the parameters for SNMP inspection. When you enter this command, the system enters the SNMP map configuration mode, which lets you enter the different commands used for defining the specific map. After defining the SNMP map, you use the inspect snmp command to enable the map. Then you use the class-map, policy-map, and service-policy commands to define a class of traffic, to apply the inspect command to the class, and to apply the policy to one or more interfaces. Examples The following example shows how to identify SNMP traffic, define a SNMP map, define a policy, and apply the policy to the outside interface. hostname(config)# access-list snmp-acl permit tcp any any eq 161 hostname(config)# access-list snmp-acl permit tcp any any eq 162 hostname(config)# class-map snmp-port hostname(config-cmap)# match access-list snmp-acl hostname(config-cmap)# exit hostname(config)# snmp-map inbound_snmp hostname(config-snmp-map)# deny version 1 hostname(config-snmp-map)# exit hostname(config)# policy-map inbound_policy hostname(config-pmap)# class snmp-port hostname(config-pmap-c)# inspect snmp inbound_snmp 30-36

Chapter 30 snmp-map hostname(config-pmap-c)# Related Commands Commands Description class-map Defines the traffic class to which to apply security actions. deny version Disallows traffic using a specific version of SNMP. inspect snmp Enables SNMP application inspection. policy-map Associates a class map with specific security actions. 30-37

snmp-server community Chapter 30 snmp-server community To set the SNMP community string, use the snmp-server community command in global configuration mode. To remove the SNMP community string, use the no form of this command. snmp-server community community-string no snmp-server community community-string Syntax Description community-string Sets the SNMP community string. Defaults The default community string is public. Global configuration Release Modification Preexisting This command was preexisting. 8.2(1) The text argument was changed to the community-string argument. Usage Guidelines The SNMP community string is a shared secret among the SNMP management station and the network nodes being managed. It is used only for Version 1 and 2c communication between the management station and the device. The adaptive security appliance uses a key to determine whether or not the incoming SNMP request is valid. For example, you could designate a site with a community string and then configure the routers, the adaptive security appliance, and the management station with this same string. The adaptive security appliance uses this string and does not respond to requests with an invalid community string. Examples The following example sets the community string to onceuponatime : hostname(config)# snmp-server community onceuponatime Related Commands 30-38

Chapter 30 snmp-server community Command clear configure snmp-server snmp-server contact snmp-server enable snmp-server host snmp-server location Description Clears the SNMP counters. Sets the SNMP contact name. Enables SNMP on the adaptive security appliance. Sets the SNMP host address. Sets the SNMP server location string. 30-39